CVE-2026-117568 Details
Description
mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.
A command injection vulnerability has been identified in mcp-ffmpeg versions through 1.0.5. This vulnerability allows attackers to execute arbitrary shell commands by manipulating the videoPath or outputDir parameters in the resize-video, extract-audio, and get-video-info tools. The issue arises because these parameters are passed directly into command strings without proper sanitization, enabling command injection through techniques like command substitution or by escaping double quotes to break out of the string context.
Replace the use of 'exec' from the 'child_process' module with 'execFile' or 'execFileSync', which do not invoke a shell and therefore cannot be exploited for command injection. This change should be applied to all three affected tools.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bitscorp-mcp/mcp-ffmpeg | [email protected] | ProductSource CodeVendor |
| https://github.com/bitscorp-mcp/mcp-ffmpeg/blob/2ec04e44850cc5ee5354c40643be8bc91c218654/src/mcp-ffmpeg.ts#L184 | [email protected] | Source CodeVendor |
| https://github.com/bitscorp-mcp/mcp-ffmpeg/issues/8 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/mcp-ffmpeg-through-1.0.5-os-command-injection-via-videopath-and-outputdir | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bitscorp-mcp mcp-ffmpeg | <= 1.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |